Newest Plugins |
|
Drupal Site Documentation Module Database Tables Information Disclosure Vulnerability:
Synopsis :
The remote web server contains a PHP application that is affected by
an information disclosure vulnerability.
Description :
The version of the Site Documentation third-party module for Drupal
installed on the remote host allows any user with 'access content'
permission to retrieve the contents of arbitrary tables in the
application's database. An attacker could leverage this issue to
retrieve sensitive information, such as usernames, password hashes,
e-mail addresses, and active SESSION IDs.
See also :
http://drupal.org/node/258547
Solution :
Upgrade to Site Documentation 5.x-1.8 / 6.x-1.1 or later.
Risk factor :
Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)Written by: This script is Copyright (C) 2008 Tenable Network Security, Inc.
|
|
Mantis Cross-Site Request Forgery Vulnerabilities:
Synopsis :
The remote web server contains a PHP application that is affected by
multiple cross-site request forgery vulnerabilities.
Description :
The version of Mantis Bug Tracker installed on the remote host does
not verify the validity of HTTP requests before performing various
administrative actions. If a remote attacker can trick a logged-in
administrator into viewing a specially-crafted page, he can leverage
this issue to launch cross-site request forgery attacks against the
affected application, such as creating additional users with
administrator privileges.
See also :
http://www.mantisbt.org/bugs/view.php?id=8995
http://mantisbt.svn.sourceforge.net/viewvc/mantisbt?view=rev&revision=5132
http://www.mantisbt.org/blog/?p=19
Solution :
Upgrade to Mantis 1.2.0a1 or later.
Risk factor :
Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)Written by: This script is Copyright (C) 2008 Tenable Network Security, Inc.
|
|
Altiris Deployment Solution < 6.9.176 Multiple Vulnerabilities:
Synopsis :
The remote Windows host has a program that is affected by multiple
vulnerabilities.
Description :
The version of the Altiris Deployment Solution installed on the remote
host reportedly is affected by several issues :
- A SQL injection vulnerability that could allow a user
to run arbitrary code
- A remote attacker may be able to obtain encrypted
Altiris Deployment Solution domain credentials without
authentication.
- A local user could leverage a GUI tooltip to access a
privileged command prompt.
- A local user can modify or delete several registry keys
used by the application, resulting in unauthorized
access to system information or disruption of service.
- A local user with access to the install directory of
Deployment Solution could replace application
components, which might then run with administrative
privileges on an affected system.
See also :
http://www.zerodayinitiative.com/advisories/ZDI-08-024
http://www.zerodayinitiative.com/advisories/ZDI-08-025
http://archives.neohapsis.com/archives/bugtraq/2008-05/0194.html
http://archives.neohapsis.com/archives/bugtraq/2008-05/0195.html
http://www.symantec.com/avcenter/security/Content/2008.05.14a.html
Solution :
Upgrade to Altiris Deployment Solution 6.9.176 or later and update
Agents.
Risk factor :
Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)Written by: This script is Copyright (C) 2008 Tenable Network Security
|
|
Altiris Deployment Solution Agent < 6.9.176 Multiple Vulnerabilities:
Synopsis :
The remote Windows host has a program that is affected by multiple
vulnerabilities.
Description :
The version of the Altiris Deployment Solution Agent installed on the
remote host reportedly is affected by several issues :
- A local user could access a privileged command prompt
via the Agent's user interface.
- A local user could leverage a GUI tooltip to access a
privileged command prompt.
- A local user can modify or delete several registry keys
used by the application, resulting in unauthorized
access to system information or disruption of service.
- A local user with access to the install directory of
Deployment Solution could replace application
components, which might then run with administrative
privileges on an affected system.
See also :
http://www.symantec.com/avcenter/security/Content/2008.05.14a.html
Solution :
Upgrade to Altiris Deployment Solution 6.9.176 or later and update
Agents.
Risk factor :
High / CVSS Base Score : 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)Written by: This script is Copyright (C) 2008 Tenable Network Security
|
|
Debian OpenSSH/OpenSSL Package Random Number Generator Weakness (SSL check):
Synopsis :
The remote SSL certificate uses a weak key.
Description :
The remote x509 certificate on the remote SSL server
has been generated on a Debian or Ubuntu system which
contains a bug in the random number generator of its OpenSSL
library.
The problem is due to a Debian packager removing nearly all
sources of entropy in the remote version of OpenSSL.
An attacker can easily obtain the private part of the remote
key and use this to set up decipher the remote session or
set up a man in the middle attack.
Solution :
Consider all cryptographic material generated on the remote host
to be guessable. In particuliar, all SSH, SSL and OpenVPN key
material should be re-generated.
See also :
http://www.nessus.org/u?5d01bdab (Debian)
http://www.nessus.org/u?f14f4224 (Ubuntu)
Risk factor :
Critical / CVSS Base Score : 10.0
(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:C)Written by: This script is Copyright (C) 2008 Tenable Network Security, Inc
|
|
Remote host has weak Debian OpenSSH Keys in ~/.ssh/authorized_keys:
Synopsis :
The remote SSH host is set up to accept authentication with
weak Debian SSH keys.
Description :
The remote host has one or more ~/.ssh/authorized_keys
files containing weak SSH public keys generated on a Debian
or Ubuntu system.
The problem is due to a Debian packager removing nearly all
sources of entropy in the remote version of OpenSSL.
This problem does not only affect Debian : any user uploading
a weak SSH key into his ~/.ssh/authorized_keys file will
compromise the security of the remote system.
An attacker could try a brute force attack against the remote
host and log in with these weak keys.
Solution :
Remove all the offending entries from ~/.ssh/authorized_keys
Risk factor :
Critical / CVSS Base Score : 10.0
(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:C)Written by: This script is Copyright (C) 2008 Tenable Network Security, Inc
|
|
Django Administration Application Cross-Site Scripting Vulnerability:
Synopsis :
The remote web server uses a web framework that is affected by a
cross-site scripting vulnerability.
Description :
The remote host is using Django, a high-level Python web framework
designed for rapid development of database-driven websites.
The administration application included with the version of Django
installed on the remote host fails to sanitize the URL before using it
to generate dynamic HTML output. An attacker may be able to leverage
this to inject arbitrary HTML and script code into a user's browser to
be executed within the security context of the affected site.
See also :
http://www.djangoproject.com/weblog/2008/may/14/security/
Solution :
Upgrade to Django version 0.96.2 / 0.95.3 / 0.91.2 or later.
Risk factor :
Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)Written by: This script is Copyright (C) 2008 Tenable Network Security, Inc.
|
|
Cross-Domain Policy File:
Synopsis :
The remote web server contains a 'crossdomain.xml' file.
Description :
The remote web server contains a cross-domain policy file. This is a
simple XML file used by Adobe's Flash Player to allow access to data
that resides outside the exact web domain from which a Flash movie
file originated.
See also :
http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html
http://www.adobe.com/go/tn_14213
http://www.nessus.org/u?74a6a9a5
http://www.nessus.org/u?50ee6db2
Solution :
Review the contents of the policy file carefully. Improper policies,
especially an unrestricted one with just '*', could allow for cross-
site request forgery and cross-site scripting attacks against the web
server.
Risk factor :
NoneWritten by: This script is Copyright (C) 2008 Tenable Network Security, Inc.
|
|
DatsoGallery Component User-Agent Header SQL Injection Vulnerability:
Synopsis :
The remote web server contains a PHP script that is prone to a SQL
injection attack.
Description :
The version of the DatsoGallery component for Joomla or Mambo
installed on the remote host fails to sanitize user-supplied input to
the User-Agent header before using it in a database query in
'sub_votepic.php'. Regardless of PHP's 'magic_quotes_gpc' setting, an
attacker may be able to exploit this issue to manipulate database
queries, leading to disclosure of sensitive information, execution of
arbitrary code, or attacks against the underlying database.
Solution :
Unknown at this time.
Risk factor :
High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)Written by: This script is Copyright (C) 2008 Tenable Network Security, Inc.
|
|
Firebird SYSDBA Unauthorized Authentication Vulnerability:
Synopsis :
The remote database server allows remote connections to its
administrative account without a password.
Description :
The version of Firebird on the remote host sets the 'ISC_PASSWORD'
environment variable before starting the database server and uses that
for remote client connections when a password is not supplied. An
attacker can leverage this issue to connect as 'SYSDBA' with an empty
password and gain access to any database on the affected host except
for 'security2.fdb', which holds the database user credentials.
See also :
http://bugs.gentoo.org/show_bug.cgi?id=216158
http://www.gentoo.org/security/en/glsa/glsa-200805-06.xml
http://www.securityfocus.com/archive/1/491871/30/0/threaded
Solution :
If running under Gentoo, use emerge to upgrade to
dev-db/firebird-2.0.3.12981.0-r6 or later.
Otherwise, ensure that the environment variables 'ISC_USER' and
'ISC_PASSWORD' are not set when starting the service.
Risk factor :
High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)Written by: This script is Copyright (C) 2008 Tenable Network Security, Inc.
|
|
Firebird Default Credentials:
Synopsis :
The remote service is protected with default credentials.
Description :
The version of Firebird on the remote host uses default credentials to
control access. Knowing these, an attacker can gain administrative
access to the affected application.
See also :
http://www.firebirdsql.org/manual/qsg2-config.html
Solution :
Use the application's 'gsec' utility to change the password for the
'SYSDBA' account.
Risk factor :
High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)Written by: This script is Copyright (C) 2008 Tenable Network Security, Inc.
|
|
Debian OpenSSH/OpenSSL Package Random Number Generator Weakness:
Synopsis :
The remote SSH host keys are weak.
Description :
The remote SSH host key has been generated on a Debian
or Ubuntu system which contains a bug in the random number
generator of its OpenSSL library.
The problem is due to a Debian packager removing nearly all
sources of entropy in the remote version of OpenSSL.
An attacker can easily obtain the private part of the remote
key and use this to set up decipher the remote session or
set up a man in the middle attack.
Solution :
Consider all cryptographic material generated on the remote host
to be guessable. In particuliar, all SSH, SSL and OpenVPN key
material should be re-generated.
See also :
http://www.nessus.org/u?5d01bdab (Debian)
http://www.nessus.org/u?f14f4224 (Ubuntu)
Risk factor :
Critical / CVSS Base Score : 10.0
(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:C)Written by: This script is Copyright (C) 2008 Tenable Network Security, Inc
|
|
Vulnerabilities in Microsoft Malware Protection Engine Could Allow Denial of Service (952044):
Synopsis :
It is possible to crash the AntiMalware program.
Description :
The remote host is running a version of Windows Malware Protection engine which
is vulnerable to a bug in the file handling routine which may allow an
attacker to crash the protection engine.
Solution :
Microsoft has released a set of patches for Windows Defender and Live OneCare:
http://www.microsoft.com/technet/security/bulletin/ms08-029.mspx
Risk factor :
Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)Written by: This script is Copyright (C) 2008 Tenable Network Security, Inc
|
|
Vulnerability in Microsoft Jet Database Engine Could Allow Remote Code Execution (950749):
Synopsis :
Arbitrary code can be executed on the remote host through database engine.
Description :
The remote host has a bug in its Microsoft Jet Database Engine (837001).
An attacker may exploit one of these flaws to execute arbitrary code on the
remote system.
To exploit this flaw, an attacker would need the ability to craft a specially
malformed database query and have this engine execute it.
Solution :
Microsoft has released a set of patches for Windows 2000, XP and 2003 :
http://www.microsoft.com/technet/security/bulletin/ms08-028.mspx
Risk factor :
High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)Written by: This script is Copyright (C) 2008 Tenable Network Security, Inc
|
|
Vulnerability in Microsoft Publisher Could Allow Remote Code Execution (951208):
Synopsis :
Arbitrary code can be executed on the remote host through Microsoft
Publisher.
Description :
The remote host is running a version of Microsoft Publisher
which is subject to a flaw which may allow arbitrary code to be run.
An attacker may use this to execute arbitrary code on this host.
To succeed, the attacker would have to send a rogue file to
a user of the remote computer and have it open it. Then a bug in
the font parsing handler would result in code execution.
Solution :
Microsoft has released a set of patches for Publisher 2000, XP, 2003 and 2007:
http://www.microsoft.com/technet/security/bulletin/ms08-027.mspx
Risk factor :
High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)Written by: This script is Copyright (C) 2008 Tenable Network Security
|
|
Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (951207):
Synopsis :
Arbitrary code can be executed on the remote host through Microsoft Word.
Description :
The remote host is running a version of Microsoft Word
which is subject to a flaw which may allow arbitrary code to be run.
An attacker may use this to execute arbitrary code on this host.
To succeed, the attacker would have to send a rogue file to
a user of the remote computer and have it open it. Then a bug in
the font parsing handler would result in code execution.
Solution :
Microsoft has released a set of patches for Word 2000, XP, 2003 and 2007 :
http://www.microsoft.com/technet/security/bulletin/ms08-026.mspx
Risk factor :
High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)Written by: This script is Copyright (C) 2008 Tenable Network Security, Inc
|
|
[DSA1575] DSA-1575-1 linux-2.6:
A vulnerability has been discovered in the Linux kernel that may lead
to a denial of service. The Common Vulnerabilities and Exposures
project identifies the following problem:
Alexander Viro discovered a race condition in the fcntl code that
may permit local users on multi-processor systems to execute parallel
code paths that are otherwise prohibited and gain re-ordered access
to the descriptor table.
For the stable distribution (etch), this problem has been fixed in version
2.6.18.dfsg.1-18etch4.
Solution : http://www.debian.org/security/2008/dsa-1575
Risk factor : HighWritten by: This script is (C) 2008 Michel Arboi <mikhail@nessus.org>
|
|
[DSA1574] DSA-1574-1 icedove:
Several remote vulnerabilities have been discovered in the Icedove mail
client, an unbranded version of the Thunderbird client. The Common
Vulnerabilities and Exposures project identifies the following problems:
"moz_bug_r_a4" discovered that variants of CVE-2007-3738 and
CVE-2007-5338 allow the execution of arbitrary code through
XPCNativeWrapper.
"moz_bug_r_a4" discovered that insecure handling of event
handlers could lead to cross-site scripting.
Boris Zbarsky, Johnny Stenback, and "moz_bug_r_a4" discovered
that incorrect principal handling can lead to cross-site
scripting and the execution of arbitrary code.
Tom Ferris, Seth Spitzer, Martin Wargers, John Daggett and Mats
Palmgren discovered crashes in the layout engine, which might
allow the execution of arbitrary code.
"georgi", "tgirmann" and Igor Bukanov discovered crashes in the
Javascript engine, which might allow the execution of arbitrary
code.
For the stable distribution (etch), these problems have been fixed in
version 1.5.0.13+1.5.0.15b.dfsg1+prepatch080417a-0etch1.
We recommend that you upgrade your icedove packages.
Solution : http://www.debian.org/security/2008/dsa-1574
Risk factor : HighWritten by: This script is (C) 2008 Michel Arboi <mikhail@nessus.org>
|
|
[DSA1573] DSA-1573-1 rdesktop:
Several remote vulnerabilities have been discovered in rdesktop, a
Remote Desktop Protocol client. The Common Vulnerabilities and
Exposures project identifies the following problems:
Remote exploitation of an integer underflow vulnerability allows
attackers to execute arbitrary code with the privileges of the
logged-in user.
Remote exploitation of a BSS overflow vulnerability allows
attackers to execute arbitrary code with the privileges of the
logged-in user.
Remote exploitation of an integer signedness vulnerability allows
attackers to execute arbitrary code with the privileges of the
logged-in user.
For the stable distribution (etch), these problems have been fixed in
version 1.5.0-1etch2.
Solution : http://www.debian.org/security/2008/dsa-1573
Risk factor : HighWritten by: This script is (C) 2008 Michel Arboi <mikhail@nessus.org>
|
|
[DSA1572] DSA-1572-1 php5:
Several vulnerabilities have been discovered in PHP, a server-side,
HTML-embedded scripting language. The Common Vulnerabilities and
Exposures project identifies the following problems:
The glob function allows context-dependent attackers to cause
a denial of service and possibly execute arbitrary code via
an invalid value of the flags parameter.
Integer overflow allows context-dependent attackers to cause
a denial of service and possibly have other impact via a
printf format parameter with a large width specifier.
Stack-based buffer overflow in the FastCGI SAPI.
The escapeshellcmd API function could be attacked via
incomplete multibyte chars.
For the stable distribution (etch), these problems have been fixed in
version 5.2.0-8+etch11.
Solution : http://www.debian.org/security/2008/dsa-1572
Risk factor : HighWritten by: This script is (C) 2008 Michel Arboi <mikhail@nessus.org>
|
|
[DSA1571] DSA-1571-1 openssl:
Luciano Bello discovered that the random number generator in Debian's
openssl package is predictable. This is caused by an incorrect
Debian-specific change to the openssl package (CVE-2008-0166). As a
result, cryptographic key material may be guessable.
This is a Debian-specific vulnerability which does not affect other
operating systems which are not based on Debian. However, other systems
can be indirectly affected if weak keys are imported into them.
It is strongly recommended that all cryptographic key material which has
been generated by OpenSSL versions starting with 0.9.8c-1 on Debian
systems is recreated from scratch. Furthermore, all DSA keys ever used
on affected Debian systems for signing or authentication purposes should
be considered compromised
the Digital Signature Algorithm relies on a
secret random value used during signature generation.
The first vulnerable version, 0.9.8c-1, was uploaded to the unstable
distribution on 2006-09-17, and has since propagated to the testing and
current stable (etch) distributions. The old stable distribution
(sarge) is not affected.
Affected keys include SSH keys, OpenVPN keys, DNSSEC keys, and key
material for use in X.509 certificates and session keys used in SSL/TLS
connections. Keys generated with GnuPG or GNUTLS are not affected,
though.
A detector for known weak key material will be published at:
<http://security.debian.org/project/extra/dowkd/dowkd.pl.gz>
<http://security.debian.org/project/extra/dowkd/dowkd.pl.gz.asc>
(OpenPGP signature)
Instructions how to implement key rollover for various packages will be
published at:
<http://www.debian.org/security/key-rollover/>
This web site will be continously updated to reflect new and updated
instructions on key rollovers for packages using SSL certificates.
Popular packages not affected will also be listed.
In addition to this critical change, two other vulnerabilities have been
fixed in the openssl package which were originally scheduled for release
with the next etch point release: OpenSSL's DTLS (Datagram TLS,
basically "SSL over UDP") implementation did not actually implement the
DTLS specification, but a potentially much weaker protocol, and
contained a vulnerability permitting arbitrary code execution
(CVE-2007-4995). A side channel attack in the integer multiplication
routines is also addressed (CVE-2007-3108).
For the stable distribution (etch), these problems have been fixed in
version 0.9.8c-4etch3.
Solution : http://www.debian.org/security/2008/dsa-1571
Risk factor : HighWritten by: This script is (C) 2008 Michel Arboi <mikhail@nessus.org>
|
|
[GLSA-200805-13] PTeX: Multiple vulnerabilities:
The remote host is affected by the vulnerability described in GLSA-200805-13
(PTeX: Multiple vulnerabilities)
Multiple issues were found in the teTeX 2 codebase that PTeX builds
upon (GLSA 200709-17, GLSA 200711-26). PTeX also includes vulnerable
code from the GD library (GLSA 200708-05), from Xpdf (GLSA 200709-12,
GLSA 200711-22) and from T1Lib (GLSA 200710-12).
Impact
Remote attackers could possibly execute arbitrary code and local
attackers could possibly overwrite arbitrary files with the privileges
of the user running PTeX via multiple vectors, e.g. enticing users to
open specially crafted files.
Workaround
There is no known workaround at this time.
References:
http://www.gentoo.org/security/en/glsa/glsa-200708-05.xml
http://www.gentoo.org/security/en/glsa/glsa-200709-12.xml
http://www.gentoo.org/security/en/glsa/glsa-200709-17.xml
http://www.gentoo.org/security/en/glsa/glsa-200710-12.xml
http://www.gentoo.org/security/en/glsa/glsa-200711-22.xml
http://www.gentoo.org/security/en/glsa/glsa-200711-26.xml
Solution:
All PTeX users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/ptex-3.1.10_p20071203"
Risk factor : Medium
Written by: (C) 2008 Michel Arboi <mikhail@nessus.org>
|
|
[GLSA-200805-12] Blender: Multiple vulnerabilities:
The remote host is affected by the vulnerability described in GLSA-200805-12
(Blender: Multiple vulnerabilities)
Stefan Cornelius (Secunia Research) reported a boundary error within
the imb_loadhdr() function in in the file
source/blender/imbuf/intern/radiance_hdr.c when processing RGBE images
(CVE-2008-1102). Multiple vulnerabilities involving insecure usage of
temporary files have also been reported (CVE-2008-1103).
Impact
A remote attacker could entice a user to open a specially crafted file
(.hdr or .blend), possibly resulting in the remote execution of
arbitrary code with the privileges of the user running the application.
Workaround
There is no known workaround at this time.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1102
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1103
Solution:
All Blender users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/blender-2.43-r2"
Risk factor : Medium
Written by: (C) 2008 Michel Arboi <mikhail@nessus.org>
|
|
[GLSA-200805-11] Chicken: Multiple vulnerabilities:
The remote host is affected by the vulnerability described in GLSA-200805-11
(Chicken: Multiple vulnerabilities)
Chicken includes a copy of PCRE which is vulnerable to multiple buffer
overflows and memory corruption vulnerabilities (GLSA 200711-30).
Impact
An attacker could entice a user to process specially crafted regular
expressions with Chicken, which could possibly lead to the execution of
arbitrary code, a Denial of Service or the disclosure of sensitive
information.
Workaround
There is no known workaround at this time.
References:
http://www.gentoo.org/security/en/glsa/glsa-200711-30.xml
Solution:
All Chicken users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-scheme/chicken-3.1.0"
Risk factor : Medium
Written by: (C) 2008 Michel Arboi <mikhail@nessus.org>
|
|
[GLSA-200805-10] Pngcrush: User-assisted execution of arbitrary code:
The remote host is affected by the vulnerability described in GLSA-200805-10
(Pngcrush: User-assisted execution of arbitrary code)
It has been reported that Pngcrush includes a copy of libpng that is
vulnerable to a memory corruption (GLSA 200804-15).
Impact
A remote attacker could entice a user to process a specially crafted
PNG image, possibly resulting in the execution of arbitrary code with
the privileges of the user running the application, or a Denial of
Service.
Workaround
There is no known workaround at this time.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1382
http://www.gentoo.org/security/en/glsa/glsa-200804-15.xml
Solution:
All Pngcrush users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/pngcrush-1.6.4-r1"
Risk factor : Medium
Written by: (C) 2008 Michel Arboi <mikhail@nessus.org>
|
|
[GLSA-200805-09] MoinMoin: Privilege escalation:
The remote host is affected by the vulnerability described in GLSA-200805-09
(MoinMoin: Privilege escalation)
It has been reported that the user form processing in the file
userform.py does not properly manage users when using Access Control
Lists or a non-empty superusers list.
Impact
A remote attacker could exploit this vulnerability to gain superuser
privileges on the application.
Workaround
There is no known workaround at this time.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1937
Solution:
All MoinMoin users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/moinmoin-1.6.3"
Risk factor : Medium
Written by: (C) 2008 Michel Arboi <mikhail@nessus.org>
|
|
FreeBSD : vorbis-tools -- Speex header processing vulnerability (1122):
The remote host is missing an update to the system
The following package is affected: vorbis-tools
Solution : Update the package on the remote host
See also :
Written by: This script is Copyright (C) 2008 Tenable Network Security
|
|
AIX 520010 : U818045:
Synopsis :
The remote host is missing a vendor supplied security patch
Description :
The remote host is missing AIX PTF U818045 which is related
to the security of the package devices.pci.ad100501.rte
You should install this PTF for your system to be up-to-date.
Solution :
Run 'suma -x -a RqType=Security' on the remote system
Risk factor :
HighWritten by: This script is Copyright (C) 2008 Tenable Network Security
|
|
AIX 520010 : U817525:
Synopsis :
The remote host is missing a vendor supplied security patch
Description :
The remote host is missing AIX PTF U817525 which is related
to the security of the package bos.acct
You should install this PTF for your system to be up-to-date.
Solution :
Run 'suma -x -a RqType=Security' on the remote system
Risk factor :
HighWritten by: This script is Copyright (C) 2008 Tenable Network Security
|
|
AIX 520010 : U817524:
Synopsis :
The remote host is missing a vendor supplied security patch
Description :
The remote host is missing AIX PTF U817524 which is related
to the security of the package bos.rte.net
You should install this PTF for your system to be up-to-date.
Solution :
Run 'suma -x -a RqType=Security' on the remote system
Risk factor :
HighWritten by: This script is Copyright (C) 2008 Tenable Network Security
|
|
AIX 520010 : U817523:
Synopsis :
The remote host is missing a vendor supplied security patch
Description :
The remote host is missing AIX PTF U817523 which is related
to the security of the package devices.scsi.disk.rte
You should install this PTF for your system to be up-to-date.
Solution :
Run 'suma -x -a RqType=Security' on the remote system
Risk factor :
HighWritten by: This script is Copyright (C) 2008 Tenable Network Security
|
|
AIX 520010 : U815809:
Synopsis :
The remote host is missing a vendor supplied security patch
Description :
The remote host is missing AIX PTF U815809 which is related
to the security of the package devices.ide.cdrom.rte
You should install this PTF for your system to be up-to-date.
Solution :
Run 'suma -x -a RqType=Security' on the remote system
Risk factor :
HighWritten by: This script is Copyright (C) 2008 Tenable Network Security
|
|
AIX 520010 : U815082:
Synopsis :
The remote host is missing a vendor supplied security patch
Description :
The remote host is missing AIX PTF U815082 which is related
to the security of the package devices.chrp.base.rte
You should install this PTF for your system to be up-to-date.
Solution :
Run 'suma -x -a RqType=Security' on the remote system
Risk factor :
HighWritten by: This script is Copyright (C) 2008 Tenable Network Security
|
|
AIX 520010 : U815081:
Synopsis :
The remote host is missing a vendor supplied security patch
Description :
The remote host is missing AIX PTF U815081 which is related
to the security of the package devices.pci.1410ff01.rte
You should install this PTF for your system to be up-to-date.
Solution :
Run 'suma -x -a RqType=Security' on the remote system
Risk factor :
HighWritten by: This script is Copyright (C) 2008 Tenable Network Security
|
|
AIX 520010 : U815080:
Synopsis :
The remote host is missing a vendor supplied security patch
Description :
The remote host is missing AIX PTF U815080 which is related
to the security of the package devices.iscsi_sw.rte
You should install this PTF for your system to be up-to-date.
Solution :
Run 'suma -x -a RqType=Security' on the remote system
Risk factor :
HighWritten by: This script is Copyright (C) 2008 Tenable Network Security
|
|
AIX 520010 : U815079:
Synopsis :
The remote host is missing a vendor supplied security patch
Description :
The remote host is missing AIX PTF U815079 which is related
to the security of the package devices.pci.1410bd02.diag
You should install this PTF for your system to be up-to-date.
Solution :
Run 'suma -x -a RqType=Security' on the remote system
Risk factor :
HighWritten by: This script is Copyright (C) 2008 Tenable Network Security
|
|
AIX 520010 : U815078:
Synopsis :
The remote host is missing a vendor supplied security patch
Description :
The remote host is missing AIX PTF U815078 which is related
to the security of the package bos.rte.libpthreads
You should install this PTF for your system to be up-to-date.
Solution :
Run 'suma -x -a RqType=Security' on the remote system
Risk factor :
HighWritten by: This script is Copyright (C) 2008 Tenable Network Security
|
|
AIX 520010 : U815077:
Synopsis :
The remote host is missing a vendor supplied security patch
Description :
The remote host is missing AIX PTF U815077 which is related
to the security of the package bos.sysmgt.nim.client
You should install this PTF for your system to be up-to-date.
Solution :
Run 'suma -x -a RqType=Security' on the remote system
Risk factor :
HighWritten by: This script is Copyright (C) 2008 Tenable Network Security
|
|
AIX 520010 : U815076:
Synopsis :
The remote host is missing a vendor supplied security patch
Description :
The remote host is missing AIX PTF U815076 which is related
to the security of the package bos.net.tcp.server
You should install this PTF for your system to be up-to-date.
Solution :
Run 'suma -x -a RqType=Security' on the remote system
Risk factor :
HighWritten by: This script is Copyright (C) 2008 Tenable Network Security
|
|
AIX 520010 : U815075:
Synopsis :
The remote host is missing a vendor supplied security patch
Description :
The remote host is missing AIX PTF U815075 which is related
to the security of the package bos.net.tcp.smit
You should install this PTF for your system to be up-to-date.
Solution :
Run 'suma -x -a RqType=Security' on the remote system
Risk factor :
HighWritten by: This script is Copyright (C) 2008 Tenable Network Security
|
|
